> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiomancer.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Jamf Pro

> Connect Jamf Pro to Layer to inventory managed Apple devices, users, configuration policies, and compliance status across macOS and iOS endpoints.

The Jamf Pro integration covers your managed Mac, iPhone, and iPad fleet.

## What you'll need

* Jamf Pro **administrator** role with permission to create API roles and clients.
* Your Jamf Pro URL (e.g. `https://yourorg.jamfcloud.com`).
* Five minutes.

## Set it up

<Steps>
  <Step title="Create an API role in Jamf Pro">
    In Jamf Pro, go to **Settings → System → API roles and clients → API Roles → + New**.

    * Display name: `Axiom Reader`
    * Privileges: `Read Computers`, `Read Mobile Devices`, `Read Users`, `Read Groups`, `Read Computer Inventory Collection Settings`

    Save.
  </Step>

  <Step title="Create an API client">
    Go to **API Clients → + New**.

    * Display name: `Axiom`
    * API roles: select `Axiom Reader`
    * Access Token Lifetime: 30 minutes (default)
    * Authorization Type: **API Client**

    Save and copy the **Client ID** and **Client Secret** that Jamf displays.
  </Step>

  <Step title="Paste credentials into Layer">
    In Layer, go to **Integrations**, find Jamf Pro, click **Connect**, and paste:

    * Jamf Pro URL
    * Client ID
    * Client Secret
  </Step>

  <Step title="Wait for the first sync">
    The first sync mints a short-lived token, pulls devices and users, and typically finishes in 10-20 minutes.
  </Step>
</Steps>

## What gets synced

| Object         | Fields                                                        | Refresh cadence |
| -------------- | ------------------------------------------------------------- | --------------- |
| Computers      | name, serial number, OS version, last check-in, assigned user | Every 6 hours   |
| Mobile devices | name, serial, OS, model, owner                                | Every 6 hours   |
| Users          | username, email, full name                                    | Daily           |
| Smart groups   | name, criteria, member count                                  | Daily           |

## Why client credentials, not OAuth

Jamf's OAuth model is per-tenant — each customer's Jamf URL is the issuer, so a single multi-tenant OAuth app doesn't apply. The API Client pattern is what Jamf recommends for service-to-service integrations.

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 Unauthorized after working for a while">
    Tokens are short-lived (30 min default). Layer mints a new one for each sync, but if you rotated the Client Secret in Jamf, paste the new value into Layer.
  </Accordion>

  <Accordion title="Some devices missing">
    Check the API role privileges — `Read Computers` and `Read Mobile Devices` are separate. Both must be granted.
  </Accordion>
</AccordionGroup>